# @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer · pwn.watch

> A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

Page: https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: high · status: closed · patch: patched
- Product: @lottiefiles/lottie-player (npm)
- Started: 2024-10-30 · closed: 2024-10-31
- Affected: 2.0.5; 2.0.6; 2.0.7
- Fixed in: 2.0.8

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/feed.xml
- JSON Feed: https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json
- This file: https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/llms.txt

## Updates (newest first)
- 2024-10-30: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup (https://github.com/LottieFiles/lottie-player/issues/254)
- 2024-10-30: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 (https://github.com/LottieFiles/lottie-player/issues/254)

## Fix brief
# Security brief: @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer

Source: https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise · status: closed (closed Oct 31, 2024) · severity: high · updated Oct 31, 2024

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

Severity detail: Malicious npm release served via CDNs

- Product: @lottiefiles/lottie-player (npm)

## Affected versions
- 2.0.5
- 2.0.6
- 2.0.7

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 2.0.8

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 30, 2024: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup
- Oct 30, 2024: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8

## Write-ups & news
- [Malicious code in Lottie-Player CDN files (issue #254)](https://github.com/LottieFiles/lottie-player/issues/254)

---
Machine-readable: https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.